13 guides
Ai-agents
Plain-English guides on ai-agents for non-technical founders building with AI tools.
founder · 6 min read
NewSupabase Bought Turso Because Your AI Agent Keeps Creating Databases
Supabase raised $150M, acquired Turso and previewed Supabase Compute. What it means for the backend your Lovable or Bolt app quietly runs on.
founder · 6 min read
NewYour Coding Agent Posted Your Dashboard Screenshots to a Public Repo
PixelLeak: agents that couldn't attach images to pull requests made public repos instead. 13,000+ internal screenshots, 300+ companies. Here's your fix.
founder · 6 min read
NewAn Agent Deleted 48,000 Files in 103 Seconds. Here's Your Backup Plan.
A reported Claude Code incident wiped a developer's working data and git history. What actually went wrong, and the three-step setup that would have saved it.
founder · 8 min read
NewAn AI Logged Into Three Real Companies. Two of Them Weren't Hacked.
Google confirmed Gemini reached three real businesses during a test. Two logins came from credentials sitting in public repos. What that changes for you.
founder · 9 min read
NewThe Fix for Last Month's Agent Supply Chain Problem Doesn't Work
Plugin4Shell defeats SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not. Here's which version you need.
founder · 8 min read
Two Companies Counted Your Agent's Add-Ons. Both Got About One in Four Bad.
NVIDIA found 26.1% of agent skills carry vulnerabilities. AIR filters out 27%. Here are the free tools that check yours before you install.
founder · 9 min read
The Add-On You Approved Is Not the Add-On That's Running
A malicious AI add-on behaved perfectly for two calls, then went after credentials on the third. Why reviewing add-ons at install time no longer works.
founder · 8 min read
The Skill You Installed Last Month Might Be Malware Now
Attackers are cloning AI agent skills, waiting for the install count to climb, then adding the payload. 17,800 add-ons. 6.7 million installs. What to check.
founder · 9 min read
Every File Your Agent Reads Is Executable
Four separate attacks in six weeks. Config files, vendor docs, firewall logs. Same shape every time, and the fix is the same three sentences.
founder · 8 min read
Your Agent Trusts the Vendor's Docs. Nobody Owns Half of What They Point At.
Researchers found 227 install commands in company docs pointing at packages nobody owned. Agents ran them inside Fortune 500 networks in minutes.
founder · 8 min read
The Repo Someone Sent You Can Run Code Before You Type Anything
GitSpawn hits seven AI coding agents. Three are still unpatched. The fix takes one command, and it is not the one you'd guess.
founder · 8 min read
What Is Your Coding Agent Actually Allowed to Touch?
Every AI coding tool now ships permission controls. They mean different things, and both major vendors say theirs are not a security boundary.
founder · 9 min read
Your .env File Is the First Thing Your Coding Agent Reads
Putting secrets in .env was good advice for a decade. AI agents quietly broke it. What actually protects your keys now.